Critical Bugs Found in 3 Popular e-Learning Plugins for WordPress Sites

According to the Check Point Research Team, the three WordPress
plugins in question — LearnPress^[2], LearnDash^[3], and LifterLMS^[4] — have security flaws
that could permit students, as well as unauthenticated users, to
pilfer personal information of registered users and even attain
teacher privileges.

“Because of coronavirus, we’re doing everything from our homes,
including our formal learning,” Check Point Research’s Omri
Herscovici said. “The vulnerabilities found allow students, and
sometimes even unauthenticated users, to gain sensitive information
or take control of the LMS platforms.”

The three LMS systems are installed on approximately 100,000
different educational platforms, including major universities such
as the University of Florida, the University of Michigan, and the
University of Washington, among others.

LearnPress and LifterLMS alone have been downloaded over 1.6
million times since their launch.

Multiple Vulnerabilities in WordPress LMS Plugins

LMS facilitates online learning via a software application that
lets academic institutions and employers create course curriculum,
share coursework, enroll students, and evaluate students with
quizzes.

Plugins such as LearnPress, LearnDash, and LifterLMS make it
easy by adapting any WordPress site to a fully functioning and
easy-to-use LMS.

“Unexpectedly, the code doesn’t check the permissions of the
requesting user, therefore letting any student call this function,”
the researchers stated.

LearnDash, likewise, suffers from a SQL injection flaw
(CVE-2020-6009) that allows an adversary to craft a malicious SQL
query by using PayPal’s Instant Payment Notification (IPN) message service
simulator to trigger fake course enrollment transactions.
^[5]

Lastly, LifterLMS’s arbitrary file write vulnerability
(CVE-2020-6008) exploits the dynamic nature of PHP applications to
allow an attacker, e.g., a student registered for a specific
course, to change their profile name to a malicious piece of PHP
code.

In total, the flaws make it possible for attackers to steal
personal information (names, emails, usernames, passwords, etc…),
and students to change grades, retrieve tests and test answers
beforehand, and also forge certificates.

“The platforms involve payment; therefore, financial schemes are
also applicable in the case of modifying the website without
webmaster’s information,” the researchers warned.

Check Point Research said the vulnerabilities were discovered in
March and were responsibly disclosed to the concerned platforms.
All three LMS systems have since released patches to address the
issues.

It’s recommended that users upgrade to the latest versions of
these plugins.

^[1]